CVE-2026-60822

Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager component: Agent. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

EUVD-2026-61854

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Agent infrastructure. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle...

EUVD-2026-61639

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61361

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

EUVD-2026-61441

Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager component: Agent. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

MeshCentral has unsanitized data fields

Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc OS description field in its coreinfo message. The server stores this value with zero HTML sanitization meshagent.js:1903 only checks typeof == 'string'. When an admin views the device details panel, t...

CVE-2026-75130

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instruction...

CVE-2026-74038

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

CVE-2026-75130

Context7 through 2.1.2 has a prompt injection flaw in its Custom AI Instructions feature served via the MCP server. Attackers poison unsanitized instructions to exfiltrate credentials from environment files and delete files on victim machines when the agent makes routine documentation requests. C...

CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

CVE-2026-74038

Wazuh 4.0.0 before 4.14.6 is vulnerable: insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() allow an unauthenticated attacker to enroll an agent named ".." via the enrollment port, resolving traversal to the parent queue directory and deleting its subdirect...

EUVD-2026-61074

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2026-61634 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2026-63337 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....

OPENSUSE-SU-2026:21603-1 Security update for gitea-tea

This update for gitea-tea fixes the following issues: Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913: golang.org/x/crypto/ssh/agent client process termination on an unexpected response to a key listing or signing...

CVE-2026-75911

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...